Daily 9 for November 5, 2026 covers nine developments across AI, fintech, crypto, software and tech, announced between November 2 and November 4. Two are US regulatory moves that bring trading products and a network token closer to regulated markets. Two are security fixes that Linux and Ruby on Rails administrators should schedule this week.

Each item links to the company, regulator or project that published it.

1. Tencent releases Hy4 with vision and computer use

Tencent released Hy4, the newest model in its Hy family, and says it now ranks among the strongest open-weight models. Hy4 is the first Hy model that can read images, including charts and visual math problems, and the first that can operate command-line tools and graphical interfaces on its own. Tencent says it trained the model on professional software such as Blender and CAD tools. Hy4 is live in Tencent Cloud TokenHub, WorkBuddy, CodeBuddy, Yuanbao and WeCom’s assistant, and its API is offered through OpenRouter and other platforms. Tencent plans to publish the weights and system cards “in the coming days”. Tencent, November 4. Background: what a large language model is.

2. XPENG-backed researchers open-source GroundingPI

Researchers affiliated with XPENG, Peking University, the University of Hong Kong and other institutions released GroundingPI, a model of about 4 billion parameters that locates objects and their positions in images, a basic skill for robots and cars. In the team’s own evaluation across 34 perception benchmarks it scored 73.68, ahead of GPT-6 Astra at 71.54. The paper, weights and code are public. XPENG says the robotics and driving results come from simulations and offline tests, and that the work is research, not a commitment to put the model in its products. XPENG, November 4.

3. CFTC lets single-stock perpetual futures trade in the US

CFTC Chairman Michael Selig said perpetual futures on individual stocks can begin trading on US exchanges that are registered with the CFTC and have also filed notice with the SEC to trade security futures. The contracts were deemed approved under CFTC Regulation 40.3 as security futures products, so both agencies oversee them. Perpetual futures have no expiry date. Selig called the move an extension of the CFTC’s earlier approval of a bitcoin perpetual contract. His statement names no exchange and no stock. CFTC statement, November 3. Earlier: Crypto.com’s US crypto perpetuals.

VEON’s Bangladesh operator Banglalink commercially launched Mukto Pay, a digital payments platform, after Bangladesh Bank granted it a payment service provider license in August 2026. The Mukto Pay app works for customers of any mobile operator, and Banglalink customers can also use it from a basic phone. In this first phase users can send and receive money, pay utility bills and recharge mobile accounts, and pay online at more than 9,500 merchants. A separate merchant app handles registration and payments. Support for Bangla QR, the national interoperable QR standard, is planned next. VEON, November 4.

5. SEC staff call Canton Coin a “digital commodity”

The SEC’s Division of Corporation Finance issued a no-action letter saying it views Canton Coin as a digital commodity under the Commission’s March 2026 interpretation. Staff will not recommend enforcement when Super Validators, Validators and application providers mint the token programmatically, as described in Digital Asset’s October 30 request, without registering under Section 5 of the Securities Act or Section 12(g) of the Exchange Act. Staff relied on two representations: the token’s value comes from the network’s operation and supply and demand, and the network has no central party. The letter is an enforcement position only and states no legal conclusion. SEC no-action letter, November 3.

6. NYSE adds four transfer agents to its tokenized stock venue

The New York Stock Exchange signed Broadridge, Computershare, Equiniti and Superstate to support issuer-sponsored tokenized securities on its planned NYSE-affiliated venue. They join Securitize and tZERO. NYSE says Broadridge, Computershare and Equiniti together serve close to 5,000 listed companies, including nearly 99% of the S&P 500. The venue is designed for 24/7 trading, instant settlement, orders sized in dollars and stablecoin funding, and tokenized shares are meant to carry the same dividends and voting rights as ordinary ones. It still needs regulatory approval and has no launch date. NYSE, November 2.

7. Rails ships fixes for 21 security issues

The Ruby on Rails team released versions 8.0.5.2 and 8.1.4.1 to fix 21 security issues and recommends upgrading as soon as possible. The one rated critical, GHSA-f3w6-w445-fwh9, allows possible arbitrary file write and read during Active Storage image analysis. A high-severity flaw in Active Storage video previews and image processing can lead to file read and remote code execution. Other fixes cover a Strong Parameters bypass, IP spoofing through the Forwarded header on 8.1, several cross-site scripting bugs, denial-of-service issues and session handling. Each advisory links to patches for teams that cannot upgrade at once. Rails blog, November 4.

8. Debian patches an APT flaw that can run code as root

Debian fixed CVE-2026-109518 in APT, the package manager used by Debian, Ubuntu and related distributions. Max Justicz found that APT can merge two package downloads after an HTTP redirect gives them the same address. Because of how APT handled a resumed download, an attacker in the middle of the connection, such as a malicious mirror or proxy, could swap a package after it was verified and run code as root. The attack needs the retry setting Acquire::Retries above zero, which is the default from Debian 12 and Ubuntu 22.04. The fix is APT 3.0.4 for Debian 13 (trixie); the update also fixes several out-of-bounds access bugs. Debian DSA-6607-1, November 4, with affected versions on the Debian security tracker.

Qualcomm said SpaceX selected its Dragonwing QRU100 and QDU100 platforms for the terrestrial base stations of Starlink Mobile, a planned nationwide 5G network in the United States. The base stations use Massive MIMO radio units with 64 transmit and 64 receive paths. SpaceX plans to start the US rollout in 2027 and to deploy tens of thousands of sites over the multi-year agreement. Starlink says the network will combine satellite and ground coverage. No financial terms were disclosed. Qualcomm, November 4.